Some 140,000 machines remain infected with the Flashback trojan, according to estimates from Symantec, despite Apple releasing three security updates to vanquish the data-stealing malware.
Symantec, which "sinkholed" the botnet so compromised computers would communicate with servers under its control, said in a blog post Tuesday it expected numbers to have diminished more by now, considering Apple released a detection and removal capability as part of its latest update to Java for Mac OS X.
Still, the botnet's size has declined by close to 75 percent in a short stretch of time, from an initial high of some 600,000 nodes on April 9.
Symantec's analysis also turned up another interesting tidbit regarding the trojan, which so far doesn't seem to be performing any information-stealing actions. Researchers found it can receive updated information via Twitter about which command-and-control servers to contact for additional instructions.
This is accomplished "by searching for specific hashtags generated by the [Flashback] hashtag algorithm," according to the post. But this wouldn't be the first time Twitter has been used to send botnet commands.
Despite the hoopla surrounding the large infection rate, Apple's slowness to patch and many users' unwillingness to install anti-virus protection, some experts prefer to keep the Mac threat in perspective, considering the platform's market share hovers just above 10 percent.
“As the Mac becomes an increasingly popular computing platform, we will naturally see an increase in attacks geared toward the OS X platform," said Michael Sutton, vice president of security research at Zscaler. "That said, today, Mac OS X targets remain a small sliver of total malware currently in the wild."
This article originally appeared at scmagazineus.com
Copyright © SC Magazine, US edition
Issue: 315 | May 2013
Access CRN's extensive online resources including; email bulletins, community discussions and unique online news.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can log on to the CRN website or start posting comments on articles.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain '@crn.com.au' to your white-listed senders.